Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

oce-configurator-wireless-frontendnpm

Advisory published Updated

oce-configurator-wireless-frontend is a confirmed malicious npm package (MAL-2026-15940) that steals credentials and exfiltrates sensitive data (malicious versions 0.0.1, 9999.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in oce-configurator-wireless-frontend (npm)

MAL-2026-15940
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall oce-configurator-wireless-frontend

What this malware does

Package name resembles an internal Swisscom OCE package and is published at version 9999.0.0 to win resolution against a private registry. The preinstall.js lifecycle script, which runs automatically on npm install, collects installer identifiers (os.hostname, os.userInfo().username, process.cwd, __dirname, package name/version, process.platform, node version, npm user-agent) and exfiltrates them to hardcoded external endpoints via three channels: (1) an HTTP/HTTPS POST to /beacon/<token> at the Interactsh collector dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online with a fallback from HTTPS to plain HTTP on error, (2) a plain-HTTP POST to the bare IP 5.189.159.252, and (3) a DNS side channel where each identifier is hex-encoded (Buffer.from(s).toString('hex').slice(0,60)) and concatenated as subdomain labels of the oast.online host, then resolved via dns.lookup. A hardcoded token 'swisscom-oce-3b9f1c7a2e' correlates the beaconed data with the targeted organization.

The OpenSSF Package Analysis project identified 'oce-configurator-wireless-frontend' @ 9999.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

Malicious versions

2 flagged
0.0.19999.0.0

Indicators of compromise (SHA-256)

cc77f103560048dba52b38fcec719925901fc3b869cbdef722edc4a904b4dc50
6fe4573d063ecba48e64d9cc4a15c6404f3dac64b71d9c80134ac0f8a85ed5d2
191e4a78bf46781b56b290aac7b804fd9470b1ac189896b950afbaba548183e6
856e5c021bc760402cad3f5f4a2f5714e96c1adba60451e8e7e624473abcdc92

Detection & response playbook

Credential / info stealer

  1. Find it

    Search your lockfiles and build artifacts for oce-configurator-wireless-frontend (2 malicious versions).

  2. If you installed it — respond

    oce-configurator-wireless-frontend is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

  3. Did it already run?

    If oce-configurator-wireless-frontend was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. oce-configurator-wireless-frontend on npm has been identified as a malicious package (versions 0.0.1, 9999.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019673IN-MAL-2026-019740

References

Credits

  • Amazon Inspector · finder
  • OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks oce-configurator-wireless-frontend-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
oce-configurator-wireless-frontend (npm) malicious package — MAL-2026-15940 | O3 Security